A missed opportunity: amending the Defence Trade Controls Act 2012 (Cth) and research security

Abstract

Since the AUKUS Agreement was signed in 2021, there has been an ambitious reform agenda intended to align Australian export control laws with those of the US to ensure license-free exports of military and dual-use technologies upon which both Pillars of the AUKUS Agreement could be reliant. However, the Commonwealth government has missed a golden opportunity, by failing to contemplate how those export control reforms could be used to truly provide for safe and secure conduct of cutting-edge research in higher education institutions. The notion of “research security”—that is, “safeguarding the research enterprise against the misappropriation of research and development to the detriment of national or economic security, related violations of research integrity, and foreign government interference”—appears to have been far from the minds of Parliament. This paper engages in a criticism of Australian export controls from the perspective of research security, highlighting aspects of the framework which fall short of protecting our institutions from malign foreign actors. Several recommendations are also made about potential opportunities for future reform that have broader application than just the Australian context and could be adopted by other jurisdictions looking to tighten their own research security frameworks.

Table of content

Part I: Introduction

1The imposition of control over what technology one country supplies another has been a key exercise of sovereign power, especially in the military domain. When a state has a technology that offers them military supremacy, transfers which benefit that state are frequently encouraged whilst transfers which undermine that state’s superiority are condemned. It is in that context that the US, the UK, France, as well as Belgium, Luxembourg, the Netherlands and Italy originally formulated the Coordinating Committee for Multilateral Export Controls (COCOM).¹ The “gentlemen’s agreement” at the heart of COCOM was succeeded by both multilateral export control agreements (such as the Missile Technology Control Regime, the Australia Group and the Wassenaar Arrangement, discussed below) as well as domestic export control frameworks,² of which the US has been infamously referred to as the most draconian regulations in the world.³ Thus, it is striking that the US has (together with the UK and Australia) entered the strategic and technological cooperative security arrangement known as “AUKUS”.

2Constructed of two ‘Pillars’, the AUKUS Agreement enables the Royal Australian Navy to commence the building of a sovereign nuclear-powered submarine fleet (including the knowledge to construct, operate and maintain such vessels) together with strategic force enablement of the AUKUS partners through sharing of next-gen military technology: “artificial intelligence, cybertechnologies, quantum technologies” as well as undersea technologies and robotics.⁴ As such, some scholars have suggested that the US has driven AUKUS with the goal gaining a stronger military presence (via its uplifted allies) in the Indo-Pacific region as a counter to the rise of autocratic states such as China and North Korea.⁵

3The scope of sharing under the AUKUS Agreement is particularly astounding given the unusually restrictive limits on military technology transfers originating from the US. The International Traffic In Arms Regulations (ITAR) and the Arms Export Control Act of 1976 (AECA)⁶ (including President Trump’s Export Controls Reform Act of 2018)⁷ specifically prohibits the transfer of articles and services related to technologies mentioned in the AUKUS Agreement from being transferred to Australia without a license, controlling the unauthorized export of ‘defense articles’ and ‘technical data’, as well as ‘defense services’ (i.e., anecdotally called the ‘know-how’ or ‘know-why’ of military and dual-use technologies).

4This has direct implications for Australia’s higher education industry. Australia has frequently linked its defense policy to reliance upon technological development to offset its small size and geographic isolation.⁸ And much of the knowledge transfer behind uplifting of defense capabilities—both in terms of scientific knowledge and training of personnel—will occur at higher education institutions (HEIs).⁹ Therefore, the sharply increased acceptance of increasingly sophisticated and/or classified military and dual-use technologies into these institutions will challenge their ability to keep those technologies protected.¹⁰

5Numerous scholars and experts hypothesized how the sharing arrangements predicated by AUKUS could be implemented, including direct amendment of US export controls,¹¹ designating Australia as a ‘domestic source’,¹² the issue of a Presidential executive order,¹³ or even an entirely new law throwing aside US export control.¹⁴ Yet that legislative fix is now in. The 2024 National Defense Authorization Act for Fiscal Year 2024,¹⁵ together with a broader licensing regime allowed under an interim final rule issued by the State Department,¹⁶ has created obligations for the other AUKUS partners to be ‘comparable’ to the US ITAR before any transfers may occur.¹⁷

6Australia has been reasonably quick to undertake just such agenda of ‘comparability’, completing both a statutory review of its export control laws together with a rapid tranche of legislative reform early in 2024. But did Australia miss out on taking steps that would have better secured its research ecosystem from national security threats? In other words, is the legislation protecting the right things? In my opinion, it does not, and the Australian government squandered a golden opportunity to introduce critical reforms to protect its HEIs

7This paper therefore makes a critical contribution to both the existing export control and emerging research security literature. The paper will open in Part II by discussing the concept of research security, and its intersection with the laws of export controls. Part II will also examine certain aspects of HEI research which could pose (and have posed) difficulties for export control frameworks. Part III will then examine both US and Australian export controls in brief. That examination is necessary to provide essential context to the recent set of amendments to Australian export control laws compelled by the AUKUS Agreement. The paper will then (in Part IV) assess these amendments for missed opportunities to better secure the conduct of research in Australian HEIs. That Part will heavily reference both independent reviews of Australia’s export control legislation (the Thom Review in 2018 and the Tesch and Samuel Review in 2023). Finally, picking up on the findings in Part V, the paper will conclude with options for improvement of the security of HEIs research through the export control framework.

Part II: Research security and the introduction of export controls

8Research security—within the scope of this paper—refers to actions for “safeguarding the research enterprise against the misappropriation of research and development to the detriment of national or economic security, related violations of research integrity, and foreign government interference”.¹⁸ The regulation of research security takes different forms depending on the jurisdiction, but all research security frameworks currently being utilized involve “the Government, along with non-departmental public bodies…[c]ontrolling who can perform research…[p]roducing guidance on how sensitive research should be performed, stored and disseminated…[and] [r]estricting how research and research outputs are funded and acquired”.¹⁹ Research security has therefore emerged as a mechanism for controlling or regulating the ‘who’, the ‘what’ and the ‘how’ of involvement in HEIs research in the age of decaying, vulnerable or volatile geopolitical relationships.

9Such controls are usually present but scattered across numerous statutes: for example, laws that protect the rights to intellectual property,²⁰ prohibit unauthorized dealings with trade secrets / espionage,²¹ or maintain high standards of research integrity (i.e., enforcing existing obligations of disclosure around funding, conflicts of interest, etc.).²² The effectiveness of these controls might remain open to serious debate, but they have nevertheless appeared in numerous jurisdictions with high-performing HEIs in the United States,²³ Canada,²⁴ China,²⁵ the United Kingdom,²⁶ and the European Union.²⁷

10As to precisely ‘how’ research security can be provided within such frameworks, the consensus in the literature is for approaches with multiple ‘pillars’ supporting legislative controls with policies around implementing those controls. For example, in the United Kingdom, a recent report by Universities UK International suggested that the government and institutions should focus on “six domains of risk: financial, reputational, academic freedom and freedom of speech, security, relationship and personnel management, and cyber, intellectual property (IP) and data management”.²⁸ In the US, researchers must make disclosure statements relating to their employment, appointments and engagement in foreign ‘talent recruitment programs’, as well as their institutions supplying information to the government as well as performing due diligence on contracts, collaborative partners and funding bodies for all research they conduct²⁹—higher risk research warrants a higher level of scrutiny and satisfaction that the research will be conducted with the US’ interests in mind.

11Export controls can therefore be a very powerful ‘pillar’ in providing research security because they regulate the security of exchanging information, data, and physical items related to militarily relevant technologies. Unsurprisingly, there is a line of argument in the literature that export controls are not intended to be used for research security purposes, and in fact can damage the HEI environment if used for that purpose.³⁰ After all, within an academic environment, it is increasingly common for individual university researchers to cooperate across institutions at the highest levels to achieve research excellence. The academic environment is populated by numerous systems, measures and programs to demonstrate or predict a particular HEI’s achievements in research.³¹ Those HEIs then use these research-oriented metrics to demonstrate their contribution to broader society, and proof of need for future funding to continue those contributions.³² Concomitant with those measures, academics routinely push back against regulation of their conduct of research, arguing that the need for open science trumps national or sovereign concerns,³³ that nationality is not a proxy for risk,³⁴ and that the nascent forms of academic freedom are owed to all HEIs irrespective of size, output or prominence.³⁵

12The disruptive nature of technologies considered under AUKUS, coupled with national security threats implicated by the need for research security, mean that domestic regulation of military and dual-use technologies will be crucial for research security for five reasons. Firstly, almost every critical technology—and certainly most of those contemplated in the AUKUS Agreement—are dual-use in nature.³⁶ Secondly, ‘list-based’ controls simply do not possess the speed and flexibility to regulate technologies that emerge in contemporary markets. The failure of such lists in the medical and life sciences is often cited as exemplifying the challenges in taxonomic controls.³⁷ Thirdly, the external (i.e., non-governmental) funding of research at HEIs has spiked in the last two decades, both as a function of the increasing commercialization of universities but also a return on investment from the quality of academic pursuit that occurs there.³⁸ This has resulted in HEIs (and not just in Australia) being incentivized to ‘push research closer to the “D-end of the R&D spectrum”.³⁹ Fourthly, the make-up of HEI staff and student demographics has markedly shifted. Exchanges between universities are more and more recognized as contributing to research excellence, and industry placements for both students and tenured academics are becoming far more common.⁴⁰ Lastly, the geopolitical arena—once the domaine reserve of states—is becoming increasingly volatile and contested, with HEIs becoming both instruments and targets of state influence, with both benign and malign outcomes.⁴¹

13So, the use of export controls will remain a key pillar of research security endeavors in HEIs.⁴² Export control laws regulate not only physical items and devices, but also intangibles such as research data, software or technical specifications. Further, there is the flexibility of how these lists are utilized in the overall control framework. For example, not only can the content of a list of technologies subject to export control be amended almost at will by a State, but so can a list that permits or prohibits the kind or classes of person who might handle or deal with those technologies. A person or entity may be prohibited from dealing with a given technology on any ground connected with reasons of national security, economic security or foreign policy, with few reasons needing to be given and appeals largely rare.

Part III: US and Australian export controls in brief

14As outlined in one review of Australian export control law, “Australia needs a robust protective security system able to keep pace with a deteriorating global strategic environment… Australia’s export control system is a central facet of ensuring this security”.⁴³ Another review explicitly linked the protection of national security and foreign relations as a critical enabler for Australian defense and sovereign interests, because a failure to provide for adequate security would see Australia excluded from the ‘club’ of high-tech weapons providers like the US and UK.⁴⁴

15In the context of the AUKUS Agreement, both Australia and the US have international obligations relevant to the trade in military technologies. For example, under the Arms Trade Treaty (ATT)⁴⁵ states must regulate the trade in arms at “the highest possible common international standards” as well as ensuring their laws “prevent and eradicate the illicit trade in conventional arms and prevent their diversion.⁴⁶ Certain consensual arrangements—like the archetypal Wassenaar Arrangement, the origin of multilateral export controls on military technology⁴⁷—also have a role to play. Certain ‘non-standard’ military items are usually regulated by such multilateral regimes, including the Australia Group on chemical and biological weapons, the Missile Technology Control Regime and the Nuclear Suppliers Group.⁴⁸

US export controls

16The US Arms Export Control Act (AECA)⁴⁹ grants the President authority over exporting ‘defense articles and services’, delegated to the Secretary of State to assess if the transfers enhance US security and promote world peace.⁵⁰ The authority of the AECA is then implemented by two parts of the Code of Federal Regulations, the EAR⁵¹ and the ITAR.⁵²

17As mentioned above, ITAR is the US’ main tool in regulating exports of defense technology. The genesis of the ITAR was in the Cold War, and it was primarily designed to service US defense and national security interests, whilst strictly controlling who could access US military technology.⁵³ The ITAR provides a robust platform for regulation by the Department of State of ‘defense articles’, ‘technical data’ and ‘defense services’,⁵⁴ and prohibits the export, re-export and transfer of those items without authorization. The specific ‘defense articles’, ‘technical data’ and ‘defense services’ declared by the President thus formulates the US Munitions List (USML) upon which much of the ITAR’s regulatory controls are focused. What constitutes an export is incredibly broad—not only is actual exporting covered, but so is provision of technical data, transferring registration of articles, and performing acts of defense services.⁵⁵ So broad in fact are the deemed export provisions that a release of technical data to a “foreign person” is treated as an “an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency”.⁵⁶

18The Export Administration Regulations (EAR) on the other hand are regulated by the Department of Commerce, and control certain technologies which the Executive consider ought to be controlled in the interests of US technological supremacy, economic or foreign policy interests.⁵⁷ Under the EAR, exports of technologies are very broadly defined, such that the EAR describes the “release of technology to a foreign national in the United States through such means as demonstration or oral briefing is deemed an export.”⁵⁸ A helpful view to distinguish the two is that the ITAR regulates ‘traditional’ military technologies that are usually forms of weaponry, whilst the EAR regulates dual-use technologies which are more readily identifiable as used in a civilian setting.⁵⁹

19The strict protections flowing from the ITAR and EAR have come at a price. US export controls laws are frequently cited as the number one obstacle to the proper implementation of AUKUS.⁶⁰ It has been suggested that the source of the overarching problems with the ITAR is the ‘practical issues’ associated with seeking, obtaining and maintaining export licenses as well as ‘intangible, conceptual issues’ said to hark back to the ITAR’s Cold War heritage (where the US was locked in a strategic and technological battle for supremacy over Soviet Russia, a far different security environment to today).⁶¹ At the same time, the EAR defines a dual-use technology to be “one that has civil applications as well as terrorism and military or weapons of mass destruction (WMD)-related applications”,⁶² capturing a massive variety of technologies. Indeed, these restrictions are said to be “particularly burdensome and inconsistent with the objectives of technology acceleration through AUKUS”.⁶³

20Further, the US export control framework is largely decentralized and administered across numerous departments of the Federal Government. Although this paper deals only with the ITAR and EAR, the issues identified have broader implications. Whilst the US export control regime has a longstanding legal history, it has also been repeatedly reformed in the last decade to ensure the regulations “[a]s a matter of legal authority…apply to the transfer of specific or general types of technology to foreign persons…[and] their reach is not limited by law to a prescribed set of commercial circumstances”.⁶⁴

Australian export controls

21Australia’s contribution to international compliance with arms controls, and its principal form of regulation, is the Defence Trade Controls Act 2012 (Cth) (“the DTCA”).⁶⁵ The DTCA operates as a blanket prohibition of supplying or dealing in ‘DSGL technology’ without license, being anything included on the Defence Strategic Goods List (DSGL).⁶⁶ The DTCA regulates the intangible supply of DSGL software and technology, brokering of DSGL goods and technology, and publication of DSGL technology. From the perspective of US military technology, the DTCA also gives force to the Australia-US Defence Trade Cooperation Treaty.⁶⁷

22The principal restriction in the DTCA was (prior to the passage of the amendments discussed below) entirely hinged on DSGL technology being ‘supplied’⁶⁸ by a person without Ministerial approval in circumstances where such approval was required,⁶⁹ in contravention of the conditions of such approval,⁷⁰ or in contravention of a notice prohibiting that supply ex ante.⁷¹ Other prohibitions applied for goods covered by the Defence Trade Cooperation Treaty,⁷² or items on the DSGL dual-use list.⁷³

23In 2018, Dr Vivienne Thom completed a statutory review of the DTCA (the Thom Review).⁷⁴ That review found multiple gaps in the regulatory coverage of the DTCA, complexities in interpretation, and a general difficulty in both the administration and compliance with export controls.⁷⁵ One of the most significant problems identified in the Thom Review for Australian export controls was that the DTCA did not require a permit for certain exchanges of information or technology.⁷⁶ One submitter to the Thom Review asked “what precludes an Australian entity from simply arranging an overseas trip and providing access instead of seeking an intangible supply permit?.”⁷⁷ That finding has implications for research security because the definition neatly applies to a common form of collaboration between academics—the sharing of intangible knowledge in overseas settings, such as at research conferences or during joint or multinational research ventures.

24This led the Thom Review to conclude that substantial reform was necessary to bring Australia’s export controls up to date with a rapidly shifting global scientific and technological research agenda—in essence, this was also an argument to enhance Australian research security. The Department of Defence proposed that it could notify a person that some technology they were dealing with “is significant to developing or maintaining national defence capability or could be used to prejudice the security, defence or international relations of Australia.”⁷⁸ That person could then be required to apply for an export permit, even if the technology was not listed in the DSGL. That proposal was roundly criticized by industry and academia as creating imbalances between national security and international trade, would jeopardize international collaboration, lacked scrutiny and transparency, and came with increased complexity and cost.⁷⁹

25Instead, the Thom Review proposed nine recommendations: three with respect to improving the administration of export control licenses and interpretation of the DSGL, four with regard to addressing the legislative coverage of ‘emerging and sensitive military and dual-use technology’ (including the application of general monitoring and investigation powers for Defence⁸⁰), one related to cryptographic controls, and one related to employees of Australia’s nuclear science agency.⁸¹ The Government supported all nine recommendations,⁸² yet no amendments to the DTCA had been undertaken by the time Australia announced the AUKUS Agreement.

Necessary amendments

26The position Australia found itself in at the time of enacting AUKUS in 2021 was to align its export controls with those of the US and provide a “comparable” environment for the receipt of advanced military and dual-use technologies.⁸³ This was a complete reversal of direction from the findings of the Thom Review, which found that comparison of the US and Australian export control systems “was not possible or useful because of the inherent differences in the systems and the complexity of the US system.”⁸⁴ Instead, Australia was now required to have a system directly comparable for AUKUS to work.

27Reform was also “essential” for AUKUS because under both the ITAR and EAR Australia and the UK occupied the same level as countries non-allied to the US (such as Latvia⁸⁵). That should be surprising, given that—for example—Australia is a partner (alongside New Zealand, Canada, the UK and the US) in the National Technology and Industrial Base, a statutory body designed to facilitate US national security outcomes by supporting “advanced R&D and systems development” amongst the member countries.⁸⁶

28How then did Australia tackle the amendment of its export controls in the face of AUKUS?

29On 29 August 2023, the Australian Government appointed Peter Tesch and Professor Graeme Samuel to conduct the next statutory review of the DTCA (the Tesch/Samuel Review).⁸⁷ However, whilst AUKUS was not specifically mentioned, the Minister for Defence did note that the Tesch/Samuel Review would “evaluate the Act in the context of other reforms the Government is considering to defence trade”. Curiously, before the Tesch/Samuel Review was concluded, the Defence Trade Controls Amendment Act 2024 (Cth) (“DTC Amendment Act”) was introduced into Parliament on 30 November 2023, with the objective of amending the DTCA to provide for AUKUS. On its introduction, the DTC Amendment Act was referred to the Senate Standing Committee on Foreign Affairs, Defence and Trade (Senate Committee), in effect creating two separate lines of review of Australian export controls.

30These reviews revealed numerous concerns with the reach and scope of the DTC Amendment Act. Submissions to the Senate Committee focused on the “shortness in time to consider the implications of what is a complex bill and that certain proposed measures have the potential to restrict international research collaboration”.⁸⁸ Concerns were expressed about “inadvertently impact unaware university academics and researchers who routinely engage in research and publication without necessarily having full awareness of the Act’s definitions and restrictions with regards to intangible supply.”⁸⁹ Concerns were also raised with the lack of a ‘basic scientific research’ exemption, which submitters considered should have been aligned more closely to the US ITAR’s fundamental research exemption (FRE).⁹⁰ Finally, and highly relevant to the topic of this paper, issues were identified with the ‘increasingly complex compliance burden’ faced by universities,⁹¹ such that a single project could involve engagement with export controls, foreign arrangements,⁹² the Defence Industry Security Program (DISP)⁹³ and Departmental guidelines on countering foreign interference.⁹⁴

31Despite the gravity of some of the concerns raised, both the Tesch/Samuel Review and Senate Committee review largely dismissed them. The Senate Committee in particular claimed “[t]he test for the bill is whether it strikes the optimal balance between national security and international trade and research collaboration. Viewed in this light, concerns voiced by stakeholders are largely centered on perceived unintended consequences.”⁹⁵ What recommendations it did make were modest, and ironically reminiscent of most of the Thom Review’s recommendations from 2018.⁹⁶ Other members of that Senate Committee were not so convinced, issuing a dissenting report that expressed the view that “[i]n a moment of genuine political irony this Bill, which is touted as part of Australia’s national security response to a less certain world, will in fact make Australia less safe and will stunt academic and economic growth”.⁹⁷

32Irrespective of those issues, the DTC Amendment Act progressed extremely swiftly, passing both Houses of Parliament on 27 March 2024 (a mere two weeks after the Senate Committee report) and receiving Royal Assent on 8 April 2024. The amended provisions of the DTCA took effect on 1 September 2024,⁹⁸ with a further 6-month “transitional period” (on or around 8 April 2025) during which new and modified offences under the DTCA cannot be prosecuted. In essence, the DTC Amendment Act has only changed the DTCA in three ways: by uplifting the ‘basic research’ exemption out of the DSGL and into primary legislation, creating new criminal offences relating to supply of DSGL goods or services to foreign nationals, and providing a national exemption to the UK and the US from Australia’s export control permit requirements.⁹⁹

Part IV: Missed opportunities? The DTCA and research security

33The DTCA has always applied to academics and the conduct of research in Australia’s HEIs, and so has the legislative basis and regulatory ambit to play a critical role in the provision of research security by limiting or eliminating unwanted technology transfers.¹⁰⁰ This is especially so given that a significant proportion of intellectual capital that will be generated and utilized because of AUKUS in Australian HEIs.¹⁰¹

34Anecdotally, academics have a historical and cultural issue with the adoption of security measures.¹⁰² Concerns raised by academics and the HEI sector regarding export controls are usually not framed around proper uses of research security to protect our institutions; instead, submissions are usually concerned with projected impacts on academic freedom, international collaborations, and exchanges with foreign nationals.¹⁰³ Indeed, most of the submissions to the reviews of Australian export controls related to excluding as much HEI research as possible through the ‘basic research’ exemption.¹⁰⁴

35When the DTC Amendment Act was introduced into Parliament, the Defence Minister Richard Marles indicated that the Act would “bolster Australia's national security and protect our sensitive defence goods and technology.”¹⁰⁵ Indeed, the Minister’s comments made clear that the export control framework was specifically intended to provide for research security, saying “Australia's export control system is a key element of our protective security framework” and “[the Act] seeks to improve the government’s ability to protect our sensitive defence goods and technology… tasks [that] are central to preserving Australia’s national security and to keeping Australians safe.”¹⁰⁶ But did the DTC Amendment Act achieve those lofty goals?

36I submit that it did not. The amendments to the DTCA were undertaken with the sole purpose of meeting “comparability” with the US ITAR and with the political objective of advancing AUKUS. The opportunity for amendments to Australian export controls that could have achieved Minister Marles’ grand policy statements (and thus enhanced Australian research security) has been squandered. The following Part expresses numerous concerns with the current iteration of the DTCA through the lens of research security. Some of those concerns are quite grave, as they carry the potential to undercut the purposes of the DTCA to provide for security of our research institutions (which overwhelmingly are Australian HEIs). For others, the gravity of the concern hangs upon the interference (however unintended) occasioned by the DTCA provisions in the pursuit of academic inquiry, and the protections of academic freedom such pursuit invokes.

Fundamental research exemption (FRE)

37Prior to the amendments in the DTC Amendment Act, universities were often in an invidious position because they could be obligated to seek a permit for the purposes of exporting information to foreign researchers, because the DTCA prohibited exchanges of DSGL information or technology between Australian-based researchers and foreign nationals. The Thom Review did not believe that a FRE was required in Australian export control,¹⁰⁷ a position reversed when both the Senate Committee and the Tesch/Samuel Review completed their reports.¹⁰⁸

38This was purportedly addressed by the introduction of a FRE into the DTCA.¹⁰⁹ Anything “produced in the course of” or “for the purposes of” such “fundamental research” is excluded from the definition of DSGL technology.¹¹⁰ Such research can be either “basic or applied”, but must be conducted in circumstances that meets the conditions of both “being intended for public disclosure, or would ordinarily be published or shared broadly”, and “not subject to any restrictions on disclosure (however imposed) for purposes connected with the security or defence of Australia or any foreign country.” Australia’s definition draws contextual similarities to—but is distinct from—the exemptions in the ITAR (which exempts “research in science, engineering, or mathematics” which are published and not subject to restrictions “for proprietary or national security reasons”)¹¹¹ and the EAR (“basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community”).¹¹²

39The link between the FRE and research security is not clear cut. Put simply, research that falls into the FRE is exempt from export controls, meaning any attempt to secure it must be made using another ‘pillar’ of research security, i.e., migration restrictions, university policy, banned entity lists, etc. Thus, the breadth and scope of an FRE can determine how much and what types of research will need to be secured, and how, by each HEI.

40In that context, three criticisms may be made about Australia’s research exemption. Firstly, the Australian FRE differs slightly in language from its US equivalents in both the EAR and ITAR.¹¹³ The difference is subtle, but hinges on the treatment of proprietary research. Consider for example the following scenario: a researcher is developing a new form of metamaterial. Such a metamaterial possesses new characteristics and significant commercial value. The researcher chooses not to publish their results to protect their intellectual property. Where that researcher is based in a US HEI, the FRE under both ITAR and EAR will not apply as the researcher has ‘accepted’ a restriction on publication for proprietary reasons. The Australian researcher on the other hand has conducted research that ordinarily would be published, but the restrictions on publication are not recognized by the FRE. Thus, the research remains exempted from the DTCA and may be shared with whomever the researcher wishes, creating massive issues for research security.

41Secondly, the FRE is only triggered where outcomes of research “are intended for public disclosure, or would ordinarily be published or shared broadly.”¹¹⁴ The FRE therefore does not cover research not intended for public disclosure for reasons connected to the technology’s novelty or economic interest, rather than its military utility.¹¹⁵ Under Australian law, every employee owes their employer a common law duty of confidence (i.e., to keep secret the operations of the business),¹¹⁶ so arguably every piece of HEI research could be seen as confidential.¹¹⁷ That position is unlike the US, where publication guarantees form standard parts of research contracts.¹¹⁸

42Thirdly, the DTCA limitation is far wider than the text in the ITAR, where universities must either “accept restrictions on publication of scientific and technical information resulting from the project or activity” and/or be funded by the US government where “specific U.S. Government access and dissemination controls” apply.¹¹⁹

43On the one hand, the DTCA provision does not require the capitulation of the researchers or their HEI (as in the ITAR, where the researchers must ‘accept’ limitations), and allows the Australian government to impose arbitrary obligations on any research in the interests of the security or defense of Australia. On the other hand, there is no requirement on the government to demonstrate that any Australian interests would trigger the imposition of restrictions. As neither ‘defense’ nor ‘security’ of any foreign country is defined in the DTCA, restrictions could be imposed with regard to espionage, sabotage, politically motivated violence, promotion of communal violence, defense, acts of foreign interference and the protection of territorial and border integrity from serious threats. Imagine if an Australian researcher was collaborating with colleagues in Hong Kong on what would be captured by the FRE of the DTCA.¹²⁰ If China arbitrarily imposed national security prohibitions on that work, the wording of the DTCA would essentially ‘pick up’ those restrictions—because they are now “restrictions on disclosure (however imposed) for purposes connected with the security or defence of…any foreign country.”

Emerging technologies and Part 2 of the DSGL

44As discussed earlier, the DTCA continues to rely upon the DSGL as a statutory instrument to control a taxonomic list of technologies deemed to have either solely-military use (DSGL, Part 1) or potential dual-use (DSGL, Part 2). That reliance should be viewed as surprising, given that since 2018 the Australian Government has been on notice that the DTCA was no longer ‘fit for purpose’ in controlling the dissemination of dual-use technologies.¹²¹ Submitters to the Senate Committee were concerned that Australia’s laws risked less clarity than those of the US,¹²² whilst submitted to the Tesch/Samuel Review lamented that five years on from Thom’s recommendations, the DSGL retained the same level of ambiguity, where it was noted that the DSGL remained notoriously difficult to interpret.¹²³

45It is axiomatic that under AUKUS, both Australian HEIs and industry partners will conduct a range of research activities that will be implicated by Part 2 of the DSGL.¹²⁴ When conducting those activities, the risk of foreign influence or interference is a live one, and requires the Australian government focus reform efforts to address “alleged heightened risk of technologies being used by adversaries for military ends.”¹²⁵ Yet that does not seem to have been the focus of the DTC Amendment Act—indeed, reliance upon the DSGL has not wavered.

46That creates several issues for AUKUS research in Australian HEIs. Firstly, the exercise of the President’s power to proscribe defense articles and defense services is an exercise of executive power, not legislative. The ITAR specifically denies judicial review,¹²⁶ and appeals for decisions under the EAR are extremely limited.¹²⁷ Both the EAR and ITAR are also exempted from the usual operation of US judicial review legislation,¹²⁸ and the Supreme Court has recently taken the view that allowing appeals against the President’s executive power risks ‘structural spillover’.¹²⁹ By comparison, the DSGL is a legislative instrument made by the Minister for Defence.¹³⁰ It is potentially subject to disallowance by Parliament,¹³¹ and grounds for judicial scrutiny of the legality of DTCA decisions are also available.¹³² Availability of judicial remedies are a welcome difference between the Australian and US systems,¹³³ but the possibility remains that matters of high policy should not be permitted to be tied to political or private economic interests, rather than those of the national security and foreign policy of the nation.

47Secondly, there is a mismatch in regulatory scope with the DSGL. Export controls are usually focused on military and dual-use technologies, whilst research security takes a broader view of examining and securing technologies that might be classed as ‘in the national interest’ (including for reasons of national or economic security, or foreign policy reasons).¹³⁴ Numerous of these technologies concurrently form part of the research appetite at HEIs, an interest that will only increase when AUKUS starts to contribute funding opportunities to research. Yet the definition of ‘DSGL technology’ in the DTCA, and the offences to which that definition relates,¹³⁵ will still refer solely both military (Part 1) and dual-use (Part 2) technologies. In the US, this regulatory mismatch between military technology and technology ‘in the national interest’ is found in the EAR, a system which Australia has not adopted. Put another way, Australia has fundamentally transformed its export control laws to contain provisions comparable to the ITAR, but without creating a less onerous framework analogous to the EAR for dealing with those technologies ‘in the national interest’.¹³⁶ In other words, Australia still lacks a cohesive system that allows for the proscription (and therefore protection) of technologies which ought to be protected on economic, foreign policy, or national security grounds. This has obvious implications for research security because technologies ‘in the national interest’ risk being underregulated or not regulated at all.¹³⁷

48Thirdly, emerging technologies can be difficult to capture with export control frameworks, both at international and domestic levels.¹³⁸ In the US, this was dealt in part through the Export Control Reform Act of 2018, which permits the Department of Commerce (the same regulatory agency for the EAR) to publish new rules which link ‘emerging technologies’ not only to forms of export control through the EAR, but also limit foreign direct investment in their development under the Foreign Investment Risk Review Modernization Act of 2018 (such investment also can come under the scrutiny of the Committee on Foreign Investment in the United States (CFIUS)).¹³⁹ Australia has no such link between its DTCA and mechanisms for either foreign investment,¹⁴⁰ nor its policy vehicles for examining critical technology investment.¹⁴¹ Instead, Australian HEIs will likely end up carrying the risks of conducting research (and managing the investment) into these emerging technologies until such time as the government realizes there might be a security problem. That is itself a huge threat, given the government in Australia has a poor history of realizing security problems in emerging tech, evidenced by media findings that foreign-made drones were in active use by the Australian Defence Force¹⁴² and foreign-made cameras were installed in Parliament House.¹⁴³

End-use and retransfer control commitments

49A significant difference between the DTCA and US export control laws is the lack in the former of end-user specific regulations; that is, controls intended to keep the arms in the hands of the original recipient whilst also verifying that recipients use such articles ‘only for permitted purposes’.¹⁴⁴ Notionally, end-user monitoring is an international obligations of the ATT, acting to prevent diversion and black market sales.¹⁴⁵ Both the ITAR and EAR are intended to operate extraterritorially to constrain the US from exporting technologies and data in circumstances where it cannot be satisfied that the security of those technologies and data will be preserved.¹⁴⁶

50An extremely powerful provision of research security could have come from Australia adopting the End-User and Entity Lists of the EAR (again, by recalling that the power of export control is the flexibility of lists to “control who may research”). Those provisions permit the President to publish a list of “foreign persons and end-uses that are determined to be a threat to the national security and foreign policy of the United States.”¹⁴⁷ Further, the AECA stipulates that the President may determine that a country has “engaged in a consistent pattern of acts of intimidation or harassment directed against individuals in the United States”, the practical consequence of such a finding being that “[n]o letters of offer may be issued, no credits or guarantees may be extended, and no export licenses may be issued…”¹⁴⁸

51Australia has no similar scheme in place to prohibit dealings with named foreign entities, relying solely on trust that HEIs are checking any relevant sanctions or end-user lists proactively. The DTCA also has no such provisions, and there appears no Parliamentary intention for Australia to so closely link its foreign policy agenda to its export control framework. Indeed, it seems Parliament intended to keep the DTCA as a “permissive” statute.¹⁴⁹ The Minister may publish a list of foreign countries to whom exchanges will not be covered by the offence provisions in the DTCA, they may not do so unless they are satisfied that “specifying the foreign country in the instrument is in the interests of Australia’s national security, Australia’s foreign relations or Australia’s national economic well-being.”¹⁵⁰ The wording of that section does not however permit the Minister for Defence to use export control laws to prevent exchanges with countries or entities for whom it is not in Australia’s interests.¹⁵¹

52Another issue is the DTCA’s handling of intangibles. For example, the ITAR prohibits the export of ‘defense services’—the technical knowledge or capability enabling or supporting the use of particular technologies—in the same manner as both defense articles and technical data.¹⁵² A similar provision in the EAR provides that exports of technologies are very broadly defined, such that the EAR describes the “release of technology to a foreign national in the United States through such means as demonstration or oral briefing is deemed an export.”¹⁵³ Thus, providing intangibles to a foreign person is prima facie unlawful, depending only on where the release or transfer occurred.¹⁵⁴ It appears this was the basis that Daniel Duggan, a former US Air Force pilot accused of training Chinese pilots on how to land safely on aircraft carriers at sea, is now facing extradition from Australia to face charges related to breaching the ITAR.¹⁵⁵ For serving members and civilians in Australia’s Defence Force and Department of Defence, amendments to the Defence Act 1903 (Cth) by the Defence Amendment (Safeguarding Australia’s Military Secrets) Act 2024 (Cth) have also now created an obligation to seek a Ministerial “foreign work authorisation” if they wish to “work for, or providing training to, a foreign military or government body”.¹⁵⁶

53Although the DTCA reforms do go some way to prohibiting the transfer of intangible forms of technology (such as the “deemed export” offences of section 10A and the provision of a “defense services” offence of section 10C), there is still plenty of room for research security concerns to manifest. For example, an international student attending a HEI may conduct research on DSGL technology as part of a research initiative between the HEI and the Department of Defence, then carry that knowledge with them back to their host country and supply it to their government.¹⁵⁷ Depending on the circumstances, this might not be a supply of DSGL technology “from in Australia to outside Australia” (section 10), “in Australia to a foreign person” (section 10A), “supply from outside Australia” (section 10B), nor a provision of DSGL services (section 10C), because it is not a ‘constitutional DSGL service’ nor a ‘relevant DSGL service’.¹⁵⁸

54What seems strangest of all is that despite both the statutory reviews of the DTCA recommending investigation and enforcement powers to promote compliance with the DTCA,¹⁵⁹ the DTC Amendment Act did not provide them, and there appears little political appetite to do so.¹⁶⁰ Such powers could have (albeit indirectly) provided for uplifted research security across Australian HEIs, by ensuring a strong culture of compliance with both the DTCA provisions re-export obligations incurred receiving defense articles, technical data and defense services. In that absence, it remains entirely unclear on publicly available information whether Defence Export Controls (DEC)—the body in the Department of Defence responsible for such compliance activities—undertakes any compliance activities or has ever prosecuted any person for breaches of Australian export control laws.¹⁶¹

Part V: Possible solutions

55Having missed the opportunity to reform export controls in a manner that would have been conducive to research security, the door has not completely shut for the Australian government. However, I believe it is unlikely (barring any catastrophic event or monumental change in government) that the DTCA will be amended so shortly after the DTC Amendment Act. The policy objective of that amendment was achieved; that is, to bring Australian export controls into rough ‘comparability’ with the US ITAR to facilitate the onward progress of AUKUS. The unintended consequences of the government’s shortsightedness will likely make themselves known over the coming years—whether this results in the maligned ‘standardized’ approaches to risk said to endangers the plurality of voices intended to be heard on matters of academic publication, open science, freedoms of expression and creative thought remains to be seen.¹⁶² At the same time, academics have every right to be disappointed by their ongoing securitization. Similar types of amendments made to EU dual-use controls since 2000 have largely “shift[ed] the attention of regulatory oversight to the stage of science and technology development and makes researchers effectively co-responsible for the politics of security.”¹⁶³

56What then could be done to rectify this situation? No amount of arguing ex post is likely to shift an export control regime that has resisted the recommendations of two separate statutory reviews. Instead, academia and industry will need to work more closely with government within the parameters that Parliament has set in the DTCA and relying more fulsomely on non-law solutions such as policy, collaborative endeavors (such as boards and combines) and as much alignment of language around export control as possible. Given that many global jurisdictions are still settling the definitional arguments about what ‘research security’ encompasses (or even what to call it), these same non-law programs are the ones suggested in emerging research security literature.¹⁶⁴ Therefore, I submit that by taking these simple measures, our HEIs might be in a better position to protect the jewels of the AUKUS crown from theft or dissemination.

The role of adjudicative bodies

57Acting outside of the formalized legal structures of their host States, there has been an increase in the use of adjudicative bodies (or advisory bodies with quasi-adjudicative power) to settle disputes or provide interpretative guidance in a number of regimes that are co-regulatory to export control. In some respects, these bodies operate like their international export control counterparts like the Wassenaar Arrangement and the Australia Group, by providing broad guidelines around what technologies States should be regulating and the mechanisms for that regulation.¹⁶⁵

58In the life sciences for example, the boundaries between research that is safe to both researchers and institutions, and that which poses a grave threat to biological security and public health, can be razor thin. The conduct of ‘dual use research of concern’—generally speaking, the provision of pathogens with characteristics or functions which they do not naturally possess and may pose public health risks¹⁶⁶—has seen the formulation of at least two bodies, the National Science Advisory Board for Biosecurity (NSABB) in the US¹⁶⁷ and the Israeli Council for the Regulation of Research with Disease Pathogens.¹⁶⁸ In both cases, these bodies have been established to straddle the divide between concerns over national security and academic freedom, to shoulder the burden of both worlds, such that they act by:

59“…building on the bona fides of their distinguished members, their legitimacy emanates from their commitment to include competing perspectives. These new mechanisms may thus be more apt to handle the blurring science-state boundaries…Enforcing strict boundaries may even be counterproductive, and it may be necessary to emphasize a diplomatic approach over bureaucratic solutions, mediation over demarcation, inclusive deliberation over neutral competence.”¹⁶⁹

60Both the NSABB and the Israeli Council may issue recommendations or advisory opinions about the application of export controls to research in the life sciences which could pose a national security risk. Though such recommendations are not of themselves binding, given that the ITAR permits restrictions not just in the interests of ‘national security’ but also ‘for proprietary or national security reasons’,¹⁷⁰ it is at least arguable that certain publications subject to an NSABB recommendation could be excluded from the FRE and an export license required to support publication or disclosure.¹⁷¹ Japan has operated a similar body—the Center for Information on Security Trade Control—since the 1990s with resounding success.¹⁷²

61Australia has no such adjudicative or guidance-setting bodies under the provisions of its export control framework but could clearly benefit from one: the Thom Review, Senate Committee and Tesch/Samuel Review all heard from members at the defense-industry and defense-academia interface complaining of issues in interpretation, consistency, and guidance on the content of both the DTCA and DSGL.¹⁷³ Such a board or body should not be merely limited to the life sciences, but could be comprised of representatives from academia, defense industry, as well as the departments of Defense, Foreign Affairs, Home Affairs and the intelligence community. That body could then consider submissions about potential dual-use technologies of potential concern on a voluntary (even anonymous) basis, either from researchers across Australia’s HEIs and the intelligence community. The decisions of such a body would not be legally binding, but would be useful voices of guidance, especially for researchers who appear to bear the brunt of ensuring compliance under the revised DTCA.

62The NSABB has been criticized in the past based on its membership and mandates, with some suggesting that the predominance of influenza experts has improperly influenced their biosafety and biosecurity policy decisions, especially in the wake of COVID-19.¹⁷⁴ The establishment of an advisory body for export control would equally be marred at commencement by the same arguments around offering everyone a seat at the table whilst simultaneously deciding whose voices should be heard and whose should not. Empirical evidence in the export control sector is rare, but what does exists suggests that States which adopt new export control laws then “tend to get bogged down in the institutionalization and implementation phases of export control development.”¹⁷⁵ That said, one of the more interesting recommendations of the Tesch/Samuel Review involved Defence developing “an accreditation system to build and maintain a cadre of export control compliance advisors”¹⁷⁶ to provide advice to HEIs on their export control obligations, so perhaps the notion of an advisory body on export controls in Australia is not as improbable as it seems.

Deepening relationships between government, industry and academia

63Another avenue for Australia to resolve shortcomings in the export control system could involve better integration and coordination of export controls within and between those who administer the scheme (i.e., DEC and Defence) and those subject to it (HEIs). This could encompass anything from information-sharing networks to truly co-designed complexes or clearinghouses. According to the emerging literature on these forms of informal governance, these “trusted communities” require the inclusion of three classes of stakeholders to be successful:¹⁷⁷

• State actors, who have an understanding of the policy reasons for export control but usually lack the necessary technological know-how of emerging or dual-use technologies;

• Researchers and HEI representatives, who possess a narrow but deep area of expertise relevant to the more difficult interpretations of export control applications; and

• Industry participants, who have a fundamental understanding of economic applications of technologies but are generally financially motivated to search for self-imposed or voluntary regulatory standards to prevent lawmaking (which may be more obligatory or stifling).

64These forms of trusted communities require a more fulsome level of disclosure by State actors than is usually the case with forms of government stakeholder engagement, i.e., roundtables, consultation groups etc., but the benefits can be incredibly worthwhile. These groups can deliver strong benefits, including broader legitimacy flowing from their inclusiveness and range of expertise to a more coherent setting of policy deriving from unified views on policy.¹⁷⁸ Such relationships can also help smaller industry players get their foot in the door with government, promote best-practice and information distribution, as well as providing a vehicle for government to “sensitize enterprises operating in the field to a variety of evolving export control concerns.”¹⁷⁹

65Such communities are already in existence, including in Australia, in other fields. For example, the FINTEL Alliance operates in the field of anti-money laundering as an intelligence and innovation clearinghouse between banks and the financial intelligence regulator AUSTRAC.¹⁸⁰ The Alliance co-opts staff of banks as secondees to AUSTRAC, subjecting them to security clearances but then allowing them access to AUSTRAC’s significant intelligence holdings. Not only can this allow true cooperation in terms of operational matters (by allowing the rapid dissemination of accurate information through webs of trusted influence across the banking sector), but the Alliance also incorporate an “Innovation Hub”, where potential new challenges to the system can be sandboxed and a variety of perspectives gained to inform government policymaking.

66Even more recently, the National Science Foundation in the US has announced $67 million in funding to create the SECURE Centre, a collaborative initiative allowing information-sharing across business, government and academia.¹⁸¹ Led through the University of Washington and Texas A&M, it is intended the Centre will ‘”will link members of the U.S. research community from institutes of higher learning, nonprofits and businesses in a safe, trustworthy platform to share ideas, needs and information on research security.”¹⁸² Such a “trusted community” could very easily be established in Australia to help bridge the gap between government and academic expectations in relation to export controls and research security.

Improving other research security protections

67The final option open to Australia is to improve the interaction of export controls with other mechanisms of research security in Australian HEIs. There are many opportunities for improvement, especially in Australia which lacks a cohesive governmental policy on research security in the same vein as its AUKUS partners.

68Perhaps then, that is the first step—a comprehensive Commonwealth policy on research security. After all, the US already has both comprehensive policies formulated by the National Science Foundation, supported by several Presidential proclamations including the National Security Presidential Memorandum No 33¹⁸³—and directives from the President’s Office of Science and Technology Policy.¹⁸⁴ The National Institute for Science and Technology published the Safeguarding International Science: Research Security Framework in 2023,¹⁸⁵ specifically designed to provide uniform implementation guidance for HEIs.

69The Australian government’s efforts—typified in the UFIT Guidelines¹⁸⁶—are not only in need of significant refreshment, but also a system of implementation guidance and monitoring that ensures Australian HEIs have adopted the protections they call for. This in turn will require a far more significant acknowledgement of research security policy, and the role played by export controls in Australian HEIs, than has ever been the case. The government may very well need to ‘put its money where its mouth is’, especially in an environment where universities are being squeezed for international student income.¹⁸⁷

70At the far end of the scale, the Australian government may need to consider other forms of legislation to buttress the weaknesses in the export control system. For example, this may require the incentivization of using patents or other forms of intellectual property protection to ensure that novel developments in HEIs cannot be spirited away by foreign actors (or at least creates stronger disincentives for them to do so).¹⁸⁸ Alternately, Defence could start to make its efforts on enforcing export controls more visible—assuming they are performing them at all. The high visibility of the Export Control Joint Unit (ECJU) in the UK could be a good starting point. ECJU routinely publishes new and updated guidance specifically for HEIs, as well as case studies and three-monthly statistics on all audits and activities performed under UK export control law.¹⁸⁹

Part VIII: Conclusion

71The role of Australia’s export controls is to tread a fine line between allowing the innovations and collaborations which drive multidisciplinary and open research to flourish, whilst protecting potentially sensitive technologies or those with a military end-use from diversion to States contrary to our national interests. In that context, Australia’s DTCA plays an incredibly important supporting role in ensuring the cutting-edge research conducted at our HEIs is performed safely, securely, and without the grave risk of foreign interference or malign influence.

72The passing of the DTC Amendment Act should also have been a watershed moment in Australian research security, a time where government listened to both industry and academia to enact a set of controls that would prepare Australian researchers for participation in a highly contested geopolitical environment. Instead, the recommendations of two statutory reviews have been supplanted by political necessity, with only the barest amendments needed to ensure bottom-line comparability with the US ITAR and EAR to support the progression of the AUKUS Agreement.

73Time will tell what such political expediency has really paid for in terms of the research security of our HEIs. This paper has sought to explore some potential policy options to fix shortcomings in Australian export control law, but what is really needed is a more ambitious legislative agenda that treats research security as a genuine topic of discussion. That in turn requires academic debate and critique, not only of governmental actions taken to advance research security, but the discipline itself. In doing so, the government must also be willing to accept where it has not met the mark, especially in comparison to our international partners. Anything less will see Australia potentially taking up the mantle as the ‘weak link’ in the AUKUS chain.

Notes

To cite this article